PT-2010-4679 · Microsoft · Office Sharepoint Server+3

Published 2010-10-13 · Updated 2024-10-17 · CVE-2010-3243

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8 Microsoft Windows SharePoint Services versions 3.0 SP2 Microsoft Office SharePoint Server versions 2007 SP2

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This is due to an information disclosure vulnerability in the way HTML is filtered, which could enable cross-site scripting attacks. An attacker who successfully exploits this could execute a cross-site scripting attack on the user, allowing the attacker to execute script in the user's security context against a site using the toStaticHTML API.

Recommendations For Microsoft Internet Explorer version 8, update to a version that includes the fix for the HTML Sanitization Vulnerability. For Microsoft Windows SharePoint Services versions 3.0 SP2, apply the necessary security patches to address the information disclosure vulnerability. For Microsoft Office SharePoint Server versions 2007 SP2, consider disabling the toStaticHTML function as a temporary workaround until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3243

Affected Products

Internet Explorer

Office Sharepoint Server

Sharepoint Server

Windows Sharepoint Services

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2010-3243 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3243 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-071 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-072 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA10-285A.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3243 · Note
• http://support.avaya.com/css/P8/documents/100113324 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-071 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7637 · Note
• https://t.me/cvenotify/98682 · Telegram Post
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-072 · Note